| commit | e075623aa517b0690ec978772df008d7e00ebce5 | |
| author | David Gibson <david@gibson.dropbear.id.au> | |
| Wed, 6 Mar 2019 03:15:26 +0000 (6 14:15 +1100) | ||
| committer | David Gibson <david@gibson.dropbear.id.au> | |
| Tue, 12 Mar 2019 03:33:04 +0000 (12 14:33 +1100) | ||
| tree | d0b587c2cfa1e04bb07f10ea4b2976bcd55d6a6d | treesnapshot (tar.gz zip) |
| parent | 176dcceedd084bc2db0a3e92123e2cfb453336e7 | commitdiff |
spapr: Force SPAPR_MEMORY_BLOCK_SIZE to be a hwaddr (64-bit)
SPAPR_MEMORY_BLOCK_SIZE is logically a difference in memory addresses, and
hence of type hwaddr which is 64-bit. Previously it wasn't marked as such
which means that it could be treated as 32-bit. That will work in some
circumstances but if multiplied by another 32-bit value it could lead to
a 32-bit overflow and an incorrect result.
One specific instance of this in spapr_lmb_dt_populate() was spotted by
Coverity (CID 1399145).
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
SPAPR_MEMORY_BLOCK_SIZE is logically a difference in memory addresses, and
hence of type hwaddr which is 64-bit. Previously it wasn't marked as such
which means that it could be treated as 32-bit. That will work in some
circumstances but if multiplied by another 32-bit value it could lead to
a 32-bit overflow and an incorrect result.
One specific instance of this in spapr_lmb_dt_populate() was spotted by
Coverity (CID 1399145).
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
| include/hw/ppc/spapr.h | diffblobblamehistory |